Design/Logic Flaw

Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...

CVE-2016-2048

Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...

CVE-2016-2048

Django 1.9.x before 1.9.2 is affected: when ModelAdmin.save_as is True, remote authenticated users can bypass access controls and create ModelAdmin objects via the Save as New option while editing, abusing the change permission. Vulnerability impact is limited to Django 1.9.x prior to 1.9.2; reme...

CVE-2016-2048

Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...

python-django: Information leak through date template filter

An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format...

Moderate: Red Hat Security Advisory: python-django security update

Updated python-django packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Django Security Bypass Vulnerability (CNVD-2016-00884)

Django is a set of open source Web application framework based on the Python language . A security bypass vulnerability exists in Django that allows remote attackers to bypass security restrictions and perform unauthorized operations...

Mezzanine 4.1.0 Arbitrary File Upload

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MEZZANINE-CMS-ARBITRARY-FILE-UPLOAD.txt Vendor: =================== mezzanine.jupo.org Product: ================ Mezzanine 4.1.0 Mezzanine is an open source CMS built using the python based...

Mezzanine 4.1.0 Cross Site Scripting

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MEZZANINE-CMS-XSS.txt Vendor: =================== mezzanine.jupo.org Product: ================ Mezzanine 4.1.0 Mezzanine is an open source CMS built using the python based Django framework...

Mail.ru: [touch.lady.mail.ru] CRLF Injection

PoC: https://touch.lady.mail.ru/%0aSet-Cookie:csrftoken=x;domain=.mail.ru; HTTP Response: HTTP/1.1 301 Moved Permanently ... Location: https://lady.mail.ru/ Set-Cookie:csrftoken=x;domain=.mail.ru; Уязвимость может быть использована для обхода CSRF защиты Django сайтов или для эксплуатации XSS чер...

python-django: permission bypass

If a ModelAdmin uses saveas=True not the default, the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission...

python2-django: permission bypass

If a ModelAdmin uses saveas=True not the default, the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission...

SUSE-SU-2016:0044-1 Security update for python-Django

This update fixes the following security issues: - bnc955412, CVE-2015-8213 Possible settings leak in date template filter - bnc937522, CVE-2015-5143 Possible denial-of-service in session store - bnc937523, CVE-2015-5144 Possible Header injection - bnc941587, CVE-2015-5963 Possible...

SUSE-SU-2016:0040-1 Security update for python-Django

This update for python-Django fixes the following issues: - Prevent settings leak in date template filter. bsc955412, CVE-2015-8213...

[SECURITY] Fedora 22 Update: python-django-1.8.7-1.fc22

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Fedora Update for python-django FEDORA-2015-323274

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2015:2327-1 Security update for python-Django

This update for python-Django fixes the following issues: - Add 0004-1.6.x-fixed-a-settings-leak-possibility-in-the-date-.patch to prevent settings leak in date template filter bsc955412, CVE-2015-8213...

openSUSE Security Update : python-Django (openSUSE-2015-862)

The python-Django package was updated to fix the following security issue : - CVE-2015-8213: Fixed a problem to prevent settings leak in date template filter bnc955412. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

openSUSE Security Update : python-django (openSUSE-2015-860)

The python-django package was updated to fix the following security issue : - CVE-2015-8213: Fixed a problem to prevent settings leak in date template filter bnc955412 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Mageia: Security Advisory (MGASA-2015-0463)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...